用进化算法生成更多样、更有效的恶意提示，提升大模型安全测试效率。
RainbowPlus: Enhancing Adversarial Prompt Generation via Evolutionary Quality-Diversity Search
- 基于自适应质量-多样性搜索，多元素存档并行优化多种攻击提示。
- 在六数据集上成功率超80%，生成提示数量达基线100倍，多样指数0.84。
- 速度快9倍，开源可复现，适合研究大模型安全与对抗测试者使用。
大型语言模型虽强大，却易受恶意提示攻击产生不安全或偏见输出。现有红队测试方法存在扩展性差、资源消耗高或攻击策略单一等问题。本文提出RainbowPlus，一种基于进化计算的新型红队框架，通过自适应质量-多样性（QD）搜索增强对抗提示生成，改进经典算法如MAP-Elites，专为语言模型设计。该方法采用多元素档案存储多样高质提示，并使用综合评分函数并行评估多个提示，克服了传统QD方法中单提示档案和成对比较的局限。在六个基准数据集及四款开源大模型上的实验表明，RainbowPlus在攻击成功率（ASR）和多样性（Diverse-Score ≈ 0.84）方面均表现更优，生成提示数量最多可达基线的100倍（例如10,418 vs. 100，Ministral-8B-Instruct-2410）。在HarmBench数据集上，针对十二个大模型（十款开源、两款闭源）的测试中，平均攻击成功率达81.1%，高于AutoDAN-Turbo 3.9%，且速度提升9倍（1.45小时 vs. 13.50小时）。代码与资源已开源，支持后续研究与复现。
原文摘要 · Abstract (English)
Large Language Models (LLMs) exhibit remarkable capabilities but are susceptible to adversarial prompts that exploit vulnerabilities to produce unsafe or biased outputs. Existing red-teaming methods often face scalability challenges, resource-intensive requirements, or limited diversity in attack strategies. We propose RainbowPlus, a novel red-teaming framework rooted in evolutionary computation, enhancing adversarial prompt generation through an adaptive quality-diversity (QD) search that extends classical evolutionary algorithms like MAP-Elites with innovations tailored for language models. By employing a multi-element archive to store diverse high-quality prompts and a comprehensive fitness function to evaluate multiple prompts concurrently, RainbowPlus overcomes the constraints of single-prompt archives and pairwise comparisons in prior QD methods like Rainbow Teaming. Experiments comparing RainbowPlus to QD methods across six benchmark datasets and four open-source LLMs demonstrate superior attack success rate (ASR) and diversity (Diverse-Score $\approx 0.84$), generating up to 100 times more unique prompts (e.g., 10,418 vs. 100 for Ministral-8B-Instruct-2410). Against nine state-of-the-art methods on the HarmBench dataset with twelve LLMs (ten open-source, two closed-source), RainbowPlus achieves an average ASR of 81.1%, surpassing AutoDAN-Turbo by 3.9%, and is 9 times faster (1.45 vs. 13.50 hours). Our open-source implementation fosters further advancements in LLM safety, offering a scalable tool for vulnerability assessment. Code and resources are publicly available at https://github.com/knoveleng/rainbowplus, supporting reproducibility and future research in LLM red-teaming.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。